docs(email): record draft export evidence

docs/verification/mail-001-job-email-hub.md

@@ -2,7 +2,7 @@
 
 Updated: 2026-08-10
 
-Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-confirmed send API, editable reply UI, interrupted-send recovery, legacy SMTP retirement, send-attempt export coverage, shared application context and inert tenant-owned draft persistence are implemented and locally verified; remaining draft API/UI, provider actions and full account-deletion lifecycle remain.
+Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-confirmed send API, editable reply UI, interrupted-send recovery, legacy SMTP retirement, send-attempt/draft export coverage, shared application context and inert tenant-owned draft persistence are implemented and locally verified; remaining draft API/UI, provider actions and full account-deletion lifecycle remain.
 
 ## Revalidated current boundaries
 
@@ -144,12 +144,19 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-c
 - No route, UI, provider call, token or content log was added. Export coverage and the complete SEC-009 deletion lifecycle remain prerequisites before private draft content becomes reachable.
 - A disposable full migration-chain SQLite rehearsal is blocked in the older `AddJobEntityAndProspectStages` migration because it references `LastReminderEmailSentAt` before any migration creates it. The failure occurs before `AddEmailDrafts` and remains tracked as JT-019 schema-chain debt.
 
+## Implemented readable draft export coverage
+
+- Authenticated encrypted backups and the existing per-owner daily JSON export now include one explicit readable draft shape: job/provider/recipient/subject/plain body/thread/revision/timestamps.
+- Both paths query through the owner filter and restrict drafts to the already exported owned job IDs. Synthetic two-owner tests prove the on-demand backup excludes another tenant and each hashed daily file contains only its matching owner's content.
+- Focused export tests pass 4/4 and the full backend remains 625/625. No new public route, log, provider call or browser storage was added.
+- Daily files inherit the existing export-folder protection and retention boundary. Complete live/export/backup deletion and retention remain SEC-009 work, not an implied guarantee from MAIL-001.
+
 ## Remaining MAIL-001 work
 
 - Extend shared provider-neutral thread navigation while preserving provider capability differences; application context and Gmail unlink are now shared.
 - Add read/unread, pin/read-later/archive/spam/trash only where the provider supports it; identity, disconnected/read-only/send-capable and provider-status failure states are now explicit.
 - Share thread detail and link/unlink actions between hub and job workspace.
-- Add a bounded owner/job-validating draft API, readable export coverage, refresh recovery and compose-new-message behavior on top of the inert persistence model; replies are implemented.
+- Add a bounded owner/job-validating draft API, refresh recovery and compose-new-message behavior on top of the persistence/export model; replies are implemented.
 - Complete account deletion coverage under SEC-009 before production rollout; job-level hard-delete cascade and export coverage are verified.
 - Preserve minimal audit metadata without sensitive body logging. Free non-AI access is verified; future AI assistance remains a Pro/privacy-gated addition, not a prerequisite for basic email.
 - Complete remaining link/unlink/dismiss/draft/send/failure/two-user browser/production provider gates. Shared application-context behavior is now covered locally. No real email may be sent during repository verification.